Post

Maintainers: You don’t need to be a security engineer to improve your project’s security. 🔐 Enable these 6 free GitHub settings in under 30 minutes. 🧵

1. Add a SECURITY. md file Tell researchers how to report vulnerabilities privately, what’s in scope, and what information to include. Without clear guidance, a well-meaning reporter may resort to a public issue or struggle to reach you at all.

2. Enable private vulnerability reporting Give researchers a confidential place to report vulnerabilities directly in your repository. You can triage the report privately, collaborate on a fix, and disclose it on your timeline.

4. Enable Dependabot and dependency review Your project includes code from every package it depends on. Dependabot alerts you to known vulnerabilities. Dependency review shows what a pull request adds or upgrades and whether those changes introduce vulnerable dependencies.

5. Turn on code scanning Code scanning uses CodeQL to identify patterns that lead to vulnerabilities, including injection flaws, unsafe deserialization, and insecure GitHub Actions workflows. Default setup chooses the appropriate queries and runs them on pull requests.

6. Protect your default branch Require pull requests and at least one approval before merging. This reduces the risk of compromised credentials or accidental direct pushes. It also helps ensure security findings are addressed before code is merged.